- Freeradius-Users - lists.freeradius.org

Digest test
by Iandc Davies 31 Aug '05

31 Aug '05

All, I am using freeradiusd 1.0.4 on RedHat Linux 9 and have just run the digest test suggested in the doc area through radclient. As it stands, I receive a code 3 reply (Access-Reject). The instruction for the test tells me to do the following: 1. In the /etc/raddb/users file insert entry as below :- test Auth-Type := Digest, User-Password = "test" Reply-Message = "Hello, test with Digest" 2. Initiate radclient with a file called digest (i.e. radclient -f digest localhost auth testing123) User-Name = "test", Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7", Digest-Realm = "testrealm", Digest-Nonce = "1234abcd", Digest-Method = "INVITE", Digest-URI = "sip:5555551212@example.com", Digest-Algorithm = "MD5", Digest-User-Name = "test" The command line holds the shared secret as defined in clients.conf file. However for this test to work, I had to insert a User-Password = "xxxx" (where xxxx is the actual password), into the digest file. After this I get a code 2 reply (Access-Accept). A radiusd -X dump shows freerad trying to do a unix authentication via the rlm_unix module. I've tried to comment out any instances of unix authentication from the radiusd.conf file but with the same results. Is there a way to tell freerad not to check user-password ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

New checkItem from LDAP
by Joe H 31 Aug '05

31 Aug '05

I am trying to create a new checkItem using an attribute stored in LDAP. I would like radius to check ldap to see if the attribute exists for a user and if it does, not assign a radiusPoolName. I have a radiusSNSEnable attribute setup in ldap and in the dictionary files as a check item. I have done lots of testing and googling and I have not found a clean solution that works. Below is the entry from my users file: DEFAULT SNS-Enable != "1" USR-Framed_IP_Address_Pool_Name = "BLACKHOLE1", Idle-Timeout := "120", Fall-Through = Yes Correct me if I'm wrong but that should mean, if the SNS-Enable attribute does not equal 1, assign the USR-Framed_IP_Address_Pool_Name and Idle-Timeout. I have SNS-Enable as a checkItem mapped to radiusSNSEnable in the ldap.attrmap. Does anyone have a solution for this? Could it be a processing order problem that I'm seeing? Does it process the users file and then LDAP so it's not checking or assigning the variable properly? If I set radiusSNSEnable as a replyItem I see it in the radius reply so I know it's getting the value. Thanks in advance for anyone that can help.

2 4

Re: concurrent TTLS and PEAP usage
by Stefan.Neis＠t-online.de 31 Aug '05

31 Aug '05

Hi, > what you are saying is that I should do something like this: > > user_ttls EAP-Type != PEAP > > that however only prohibits the usage of PEAP for user_ttls while i > would like to only enable TTLS for this specific user (which is not > quite the same). Yes, however you said yourself, that you do _not_ want to only enable TTLS for this specific user since you also obviously need to enable the inner protocol used inside the tunnel... Maybe something like if EAP-TYPE isn't EAP-TTLS and FreeRadius-Proxied-To is not set for user_ttls,t then reject as a first rule and as a second rule something like if FreeRadius-Proxied-To is set and AuthType isn't PAP then reject. And similar rules for user_peap. Regards, Stefan

1 0

Different behaviour with LDAP
by Þórður Ívarsson 31 Aug '05

31 Aug '05

I am authorizing wireless network cards in "users file" with radius server (old cistron radius) and that is working fine entry like: 121212-232323 Auth-Type = Accept Only network card matching abov entry get access Now I am building new radius server with FreeRadius and users information and passwords are kept in Open-LDAP I have following entry in my "users file" DEFAULT Huntgroup-Name == "wireless", Service-Type == Framed-User, Autz-Type:=zldap-macaddr, Auth-Type := Accept Fall-Through = No and this is in "radiusd.conf" ldap ldap-macaddr { server = "localhost" identity = "cn=manager,dc=skrin,dc=local" password = kept_secret basedn = "ou=users,ou=internet,dc=skrin,dc=local" filter = "(&(macAddress=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=wireless))" base_filter = "(objectclass=radiusprofile)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # password_attribute = userPassword # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes } I have also different sections for different huntgroups of the LDAP entry in radiusd.conf for other services and they work fine. The behaviour of the radius server is like that - authorize the client/user (match against huntgroup and ldap attribute search) then authenticate the user (trying to log into ldap server with user/password), but I have Auth-Type= accept, that I understand is allowing everyone that matces the authorize section. This breaks, it allows everyone that matches huntgroup but fails authorize. Is this normal or not? Þórður Ívarsson Skrín ehf

1 0

Windows Client Authentification bevore Domain logon
by Jérémy Cluzel 31 Aug '05

31 Aug '05

How can I add this OID to my machine certs ? using CA.certs script and xpextensions file ? Regards, Jeremy Ben Walding <ben.walding at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >/ /I also found using machine certificates to be hit and miss (some >/ /machines they'd be picked up, others they wouldn't - all XP SP2 with >/ /appropriate patches). >/ / >/ /And then I stumbled on this > / />/ ///http://lists.cistron.nl/pipermail/freeradius-users/2004-July/034141.html >/ / >/ /1.3.6.1.4.1.311.17.2 >/ / >/ /After I started adding that OID to my machine certs, everything >/ /started working wonderfully. >/ / >/ /I shook my fist at Microsoft that day! >/ / >/ /Cheers, >/ / >/ /Ben >/ /

1 0

urgent:problem with shared secret
by Geraldin Arthy 31 Aug '05

31 Aug '05

Hello, I am using free radius server for sending accounting request packets and receive accounting response packets.However it displays shared secret is incorrect.Could you let me know how to configured the free radius server for radius accounting or any special configuration has to be done apart from the naslist file and clients.conf file. Please let me know as soon as possible. --------------------------------- Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather

1 0

TTLS-PAP only option for LDAP backend?
by Cian Phillips 31 Aug '05

31 Aug '05

Thanks to Alan, Thor and Vladmir for getting me this far. <grin> I have TTLS-PAP working and authenticating against our OSX LDAP server. I was wondering if anyone has had any success getting Microsoft clients to use TTLS-PAP without installing additional software as suggested in this tutorial. http://vuksan.com/linux/dot1x/wpa-client-config.html#Windows_XP Is there a simpler way to accomplish the same thing? Cian Phillips Director Network & Systems California College of the Arts Phone: (510) 594-3745 Cell: (510) 719-0091 Fax: (510) 594-3758 email: cian(a)cca.edu

2 1

A cluster of freeradius servers
by Angel L. Mateo 30 Aug '05

30 Aug '05

Hi, I want to deploy the next configuration: I have a proxy radius server (freeradius) who redirect its requests to another freeradius server. I have another freeradius server with the same configuration as this last one. What I want is to configure the proxy radius to proxy requests to one of these servers. It this fail, then it should ask to the other one. If this posible with freeradius? How do I do it? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

6 8

how to run sql query on radius startup
by Sergey Pariev 30 Aug '05

30 Aug '05

Hi All. I'm currently setting up freeeradius 1.0.4 with pgsql (8.0.3) backend, and I need to run an SQL query on radius server startup. Id like to know is it possible at all ? I've read the docs and *.sql config files but haven't found anything like this. Any suggestions ? I know I can run a query via psql from radius startup script, but I'd prefer another solution if such exists. Thanks in advance, Sergey Pariev.

3 6

ntlm_auth multiple nt4 domains peap xp
by Jamie Crawford 30 Aug '05

30 Aug '05

Hi, I have a two nt4 trusted domain infrastructure and am trying to setup freeradius to authenticate xp supplicants with peap. I have nmbd and winbindd running correctly, and can run the ntlm_auth program with no problems. But what I have found out is that my freeradius server is joined to the DOMAINA domain. So when running /usr/bin/ntlm_auth --username=domainatestuser it automatically validates the user against DOMAINA. But if I try to run /usr/bin/ntlm_auth --username=domainbtestuser it will fail. I have to add the --domain=DOMAINB for it to validate correctly. So when I use my xp supplicant to validate my user, domainatestuser (without typing in the DOMAINA), it works perfectly. If I put in DOMAINA in the domain box, I get rejected. If I try to validate the domainbtestuser using nothing for the domain box, I get rejected. If I put in DOMAINB in the domain box, I get rejected. I guess I am needing to setup realms for each domain. How do I setup DOMAINA users to go to the DOMAINA domain controllers, and how do I setup DOMAINB users to go to DOMAINB domain controllers. I shouldn't really have to setup to go do different domain controllers, I just need freeradius to pass on the "domain" in the ntlm_auth command. Thanks for any help!!!! rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:3076, id=85, length=181 NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "DOMAINB\\domainbtestuser" Calling-Station-Id = "001217a8df41" Called-Station-Id = "0001f4449c4c" NAS-Identifier = "RoamAbout AP" State = 0x1ce29e6a91a9663ff39346a69f85748c EAP-Message = 0x020800261900170301001b4ca905292ffadaa855c356acd5417b6989915df2dd32ffdc0b08d3 Message-Authenticator = 0x6dca7a93ca473745cab0f6a063b66d0e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: No '@' in User-Name = "DOMAINB\domainbtestuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_realm: Looking up realm "DOMAINB" for User-Name = "DOMAINB\domainbtestuser" rlm_realm: No such realm "DOMAINB" modcall[authorize]: module "ntdomain" returns noop for request 15 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 15 modcall: group authenticate returns invalid for request 15 auth: Failed to validate the user. Delaying request 15 for 1 seconds Finished request 15 Going to the next request Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU

2 1